The Guidelines further explain the DPIA requirement and provide a few recommendations:

Scope of a DPIA. The Working Party confirms that a single DPIA may involve a single data processing operation or a set of similar processing operations (i.e., with respect to the risks they present).

Processing operations that are subject to a DPIA. The Working Party reiterates that a DPIA is mandatory where processing is likely to result in a high risk to the rights and freedoms of individuals. The Working Party highlights several criteria to be taken into consideration by SAs when establishing their lists of the kind of processing activities that require a DPIA, including, (1) evaluation or scoring, including profiling and predicting, (2) automated decision-making by the data controller with legal or similar significant effects on the individuals, (3) systematic monitoring of individuals, (4) processing personal data on a large scale and (5) matching or combining datasets. According to the Working Party, the more criteria that is met, the more likely that such processing activities present a high risk for the individuals and therefore require a DPIA. The assessment of certain data processing operation risks, however, must still be made on a case by case basis. The Guidelines further outline cases where a DPIA would not be required, including, for example, where the processing is not likely to result in a high risk to the rights and freedoms of individuals, or a DPIA has already been conducted for similar data processing operations. In addition, according to the Working Party, a DPIA must be reviewed periodically, and in particular, when there is a change in the risks presented by the processing operations. Finally, the Working party specifies that the DPIA requirement contained in the GDPR applies to processing operations initiated after the GDPR becomes applicable (i.e., as of May 25, 2018), although it recommends that data controllers anticipate the GDPR and carry out DPIAs for processing operations already underway.

How to carry out a DPIA. Where a likely high risk processing is identified, the Working Party recommends that the DPIA be carried out prior to the processing, and as early as possible in the design of the processing operation. Also, the data controller is responsible to ensure that a DPIA is carried out. The data controller must, however, cooperate with and ask the advice of the data protection officer. In addition, the data processor must assist the data controller in carrying out the DPIA when it is involved in the processing. Further, the Guidelines reiterate that data controllers have some flexibility in determining the structure and form of a DPIA. In this respect, Annex 2 of the Guidelines provides a list of criteria for data controllers to use to assess whether or not a DPIA, or a methodology to carry out a DPIA, is sufficiently comprehensive to comply with the GDPR. Finally, the Working Party recommends that data controllers publish their DPIAs, although this is not a strict requirement under the GDPR.

Consultation of SAs. The Working Party reiterates that data controllers must consult SAs when they cannot find sufficient measures to mitigate the risks of a processing and the residual risks are still high, as well as in specific cases where required by EU Member State law.

Conclusion and Recommendations. Finally, the Working Party reiterates the importance of DPIAs as a GDPR compliance tool, in particular where high risk data processing is planned or is taking place. Whenever a likely high risk processing is identified, the Working Party recommends that data controllers: (1) choose a DPIA methodology or specify and implement a systematic DPIA process, (2) provide the DPIA report to the competent SA where required, (3) consult the SA where required, (4) periodically review the DPIA and (5) document the decisions taken in the context of the DPIA.

Annex 1 of the Guidelines contains some examples of existing DPIA frameworks, including the ones published by the Spanish, French, German and UK SAs.

The Working Party will accept comments on the draft Guidelines until May 23, 2017.

ATTORNEY ADVERTISING. Case results depend upon a variety of factors unique to each case. Case results do not guarantee or predict a similar result in any future case. Unless otherwise noted, attorneys not certified by the Texas Board of Legal Specialization.

About our Global Privacy & Cybersecurity Practice Group

Hunton & Williams’ Global Privacy and Cybersecurity practice helps companies manage data at every step of the information life cycle. The firm is a leader in its field and for the fourth consecutive year has been ranked by Computerworld magazine in a survey of more than 4,000 corporate privacy leaders as the top law firm globally for privacy and data security. Chambers and Partners also rated Hunton & Williams the top privacy and data security practice in its Chambers Global, Chambers USA and Chambers UK guides.